feat!: remove the ci-runner canary and production HA-proof apparatus - #125
Conversation
The org's CI-runner release process now installs releases one host at a time under real production traffic with a cheap lock-revert rollback (melodic-software/provisioning#145), so the isolated canary acceptance contract and the production HA-proof rollout gate have no callers. - Delete the local-runner-canary and production-ha-proof reusable workflows, their runtime/test/generator scripts, the canary-only hosted/self-hosted parity check, and the templates/ci-runner-canary seed (the repository's only template). - Delete the immutable-workflow-pins fetcher and test: template workflows were its only subject, so it has nothing left to pin. - tool-version-drift-check: drop the canary-runtime drift block and its now-unused runtime-lookup helpers; the pinned runtimes existed only for the canary parity contract. - Reword dotnet action fallback comments to track only the root global.json, and replace ambiguous generic-"canary" wording in the OSV guidance with explicit consumer verification runs. BREAKING CHANGE: the local-runner-canary.yml and production-ha-proof.yml reusable workflows no longer exist; their only sanctioned caller (melodic-software/ci-runner-canary) is being decommissioned. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TPPLWAtX5BWyEmghrKkYYF
|
Claude finished @kyle-sexton's task in 2m 14s —— View job PR Review
This is a clean decommission. The deletions are comprehensive, the modified files are internally consistent, and no cross-cutting references to the removed artifacts survive. A few minor observations below. Security (CLAUDE.md rules)No violations:
Findings1. Stale job name in
name: Selector and immutable-pin testsThe step name at line 69 was correctly updated to 2. Now-unnecessary Two checkout steps that previously served Neither is broken — Everything else checks out
|
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TPPLWAtX5BWyEmghrKkYYF
|
Claude finished @kyle-sexton's task in 1m 21s —— View job PR Review (updated for 3628dec)
Follow-up commit (3628dec)The second commit removes 7 link reference definitions from
A grep of the current README confirms zero remaining Status of previous findingsThe two observations from the earlier review remain open: 1. Stale job name in
name: Selector and immutable-pin testsThe immutable-pin test step was removed; the job name no longer matches what the job actually does. Cosmetic, but a one-word fix. 2. Now-unnecessary Both OverallBoth commits together form a clean, comprehensive decommission. No security rule violations, no dangling references, no widened permissions. The two open items above are cosmetic / efficiency nits — neither blocks merge. |
## Summary Part of the CI-runner canary decommission (companion to melodic-software/provisioning#145 and melodic-software/ci-workflows#125). The `melodic-canary-ubuntu-24.04-x64` scale set is being removed via github-iac, so its enumerated coverage entry in the managed-namespace test and the "and canary forms" prose mention are retired. The managed-namespace pattern itself is untouched and still generically forbids every owner-prefixed scale-set label. Deliberately left alone: the generic "reviewed canary contract" test fixture string (unrelated to the CI-runner canary) and `policy.json`/schemas (the canary label was matched by pattern, never listed). ## Verification - `node --test components/runner-policy/runner-policy.test.mjs`: 145/145 passing locally. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01TPPLWAtX5BWyEmghrKkYYF Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
## Summary Part of the CI-runner canary decommission (companion to melodic-software/provisioning#145, melodic-software/ci-workflows#125, melodic-software/standards#157). No functional change — prose and one Detail string only. - `docs/roadmap.md`: deferred-capability admission now requires "a first rolling-host rollout under production traffic with the documented health checklist" instead of a canary. - `docs/worker-image.md`: runtime isolation is observed live during each release's first rolling-host rollout; the zstd origin story is marked as the *retired* canary process (historical record kept). - `internal/app/doctor_inspector.go` + `doctor_test.go`: `github-jit-proof` skip rationale updated together — the first enable on a rolling-host rollout performs the JIT proof under real traffic. - `.github/workflows/dependency-drift.yml`: PR-body guidance now says "CI, a rolling-host rollout, and independent review". - `README.md`: drops "isolated canary" from the acceptance-gate sentence. ## Verification - `go test ./...` locally: all pass except `TestCurrentUserNamedPipeRoundTrip`, which fails identically on an unmodified tree because this machine's live production controller owns the control pipe — environmental, not related; hosted CI has no live controller. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01TPPLWAtX5BWyEmghrKkYYF Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3628dec1b6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
## Summary Follow-up to #125, addressing its Codex review finding: the removed canary-runtime drift block was incidentally the only watch on runtime pins that still ship. The daily drift check now watches those pins directly: - Reads the canonical pins from the tree: root `global.json` (.NET SDK), `markdown` action's `node-version` default, `ruff` action's `python-version` default. - Fails closed if any family's pins diverge across the tree (biome/tsc node defaults; pyright/check-jsonschema python defaults; dotnet-build/dotnet-format/dependabot-lock-regen fallback SDK pins vs `global.json`). - Compares each agreed pin against the upstream first-party release index within its reviewed major/minor line (same `latest_dotnet_sdk`/`latest_node_runtime`/`latest_python_runtime` lookups the canary block used). - Absorb-procedure guidance updated to say runtime bumps update every matching default in lockstep. No linked issue. ## Related - #125 (canary apparatus removal that orphaned these pins) ## Verification - `node --test .github/scripts/*.test.cjs`: 191/191 locally. - `actionlint`: clean. - Consistency logic dry-run against the current tree: all families agree (dotnet 10.0.302, node 24.18.0, python 3.14). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01TPPLWAtX5BWyEmghrKkYYF --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
1 participant
Summary
Part of the canary decommission (companion to melodic-software/provisioning#145). The org's CI-runner release process now installs releases one host at a time under real production traffic with a cheap lock-revert rollback, so the isolated canary acceptance contract and the production HA-proof rollout gate have no callers — their only sanctioned caller, the private
ci-runner-canaryrepository, is being decommissioned via github-iac.local-runner-canary.yml+production-ha-proof.ymlreusable workflows, their runtime/test/generator scripts (production-ha-proof.cjs+ test + renderer,local-runner-canary.test.cjs,local-runner-parity.sh), and thetemplates/ci-runner-canary/seed — the repo's only template.fetch-immutable-workflow-pins.cjs+ test: template workflows were its only subject; with no templates left, it had nothing to pin. Removed its invocation steps fromci.ymlandselector-conformance.yml.latest_dotnet_sdk/latest_node_runtime/latest_python_runtimehelpers; those runtime pins existed only for the canary parity contract. Absorb-procedure prose updated to match.global.json(previously "in lockstep with" the canary workflow's default).The manual failover/power-proof operator knowledge is preserved in
provisioning/runbooks/ci-runner-manual-proofs.md(PR #145).Verification
node --test .github/scripts/*.test.cjs: 191/191 passing locally.lychee --offline: 0 errors.actionlintover all four edited workflows: clean.🤖 Generated with Claude Code
https://claude.ai/code/session_01TPPLWAtX5BWyEmghrKkYYF